The module is vulnerable to relay spam!

This seems to be the same issue as http://drupal.org/node/31579 ?
I that case it should allready be sloved in the latest webfrom 4.6 ?

Does the spam infact reach the victim ?
If only you (the recipient specified in the form creation) recived the email message then the _spam_ attempt didn't work. In this case then this is more a question of abusive use of the form.
I'm not saying this is a non issue I just want to make sure what problem I should be trying to solve.
In this case the implementing http://drupal.org/node/48889 request would be the answer.

Perhaps one way to reduce this problem would be to have more sophisticated validation of each form element, beyond simply whether a field is mandatory or not. For example, a field might be numeric, in which case webform would report an error in that field on submission if it contained non-numeric characters. This should filter out automated bots, though bots could be programed to bypass the security on a particular form -- but I'm thinking this might be a bit tedious for the crackers.

Perhaps it would be possible to associate with each form field a php code snippet or function that would return true or false depending on whether the data was of the correct form. (Hmmm... it might want to return an error message too, so might need to return an array). Alternatively each field could have a regexp to be matched and error message for each form field, and/or some presets, like "numeric" or "postcode" or "phone number".

This is actually a feature that I would like to see in webform regardless of spam reduction. At the moment I can't see any obvious way of doing it, though there was some reference to hooking into nodeapi in a previous issue (http://drupal.org/node/29024) which I haven't followed up yet. When I find the time, I'll look into that, before posting a request for "custom field validation" as a new issue.

Regarding this issue, next posting might contain some useful info:
- http://drupal.org/node/25339

The author is not allowed to publish his validation code, but if you send him an e-mail he might send it to you (as he did with me). I tried the suggested code at form_mail.module and it did a good job!

However, disadvantage of the way I used form_mail was that the error messages appeared on top of a blank page - instead of on top of the form itself.

Now I use webform.module and it should be not too difficult to integrate. Unfortunately I didn't have time for it yet (and don't know when that will come), but may be it can help you guys for now.

Anyway, good luck!

mcduarte2000: still my question is the spam attempt successfull ? That is to say does the mail realy go to 'andy@...' or just to your gmail account ?
If it does go to the email address specified in the subject line I would count it as a spam problem.
If it only goes to your email account it is a abusive use problem.
I just want to make sure what problem I should fix.

There are code in place that should (or atleast tries to) address the problem described on http://www.anders.com/cms/75/Crack.Attempt/Spam.Relay

The problem is that removing the newlines (as the anders.com article suggests) will not prevent the spammer to flood you mailbox and your database server (and mine since I'm using the same webhost as you are) . The solution for this would be to add chalange-response check or a captcha check.

The FormValidator class seems nice (from what I can tell from the thread) but since the original author refuses to relase it under GPL I can't use it for webform.module =/

OK after looking on the code again my guess is that after you last update there are no more spam messages beeing sent.
On the other hand I did save the data to the database befor doing "spam filtering checks" so the submitted data was saved to the database.

I've defered the save call untill after the checks and added a error message so the user knows the data was not submitted.

Please test this .module file (based on the 4.6 version).